On his AOE conference talk, Sebastian Rose sketches the idea of an Identity and Access Management platform using single sign-on for services provided to employees and customers. https://www.aoe.com

2. AOE Single Sign-On via
an OpenID Provider

3. Disclaimer
All characters and events depicted in this film are entirely fictitious. Any similarity to actual
events or persons, living or dead, is purely coincidental.
All uses of software products and configurations depicted
in this presentation are entirely fictitious. Any similarity to
actually used software products or existing configurations
at AOE, now or in the past, is purely coincidental.

4. Services for all our needs

5. Authentication required
User = john.doe
User = jdoe

6. Motivation - Summary
No Single Sign-On
Users/Personal data sets are distributed
Permissions are managed in a distributed way
LDAP User/password is given to different services

7. Solution
Trusted authority
for identity
based on standards

8. Solution - Standards
</SAML>
openid.net

9. Solution - Products
…

10. Solution - Required steps
UI Customizing
Permissions
Groups & Roles
Operations
General setup

11. Solution - Architecture
OpenID Provider (Keycloak)
LDAP

12. Solution - Architecture II
OpenID Provider (Keycloak)
Service A Service B Service C

13. Solution - Ready for Integration

14. Solution - Summary
Single-Sign-On
Users/Personal data sets only in one place,
editable by the user
Permissions are only in one place
LDAP User/password is only handled by trusted
identity provider

15. Demo

16. Solution - Summary (add-on)
Existing software (products) problem:
If there is some kind of integration as a client:
roles and permissions are missing
No problem being Authentication
Provider; being Client is not a first
class feature

17. Questions?